Recovering Lost Photos with DEFT Linux and PhotoRec

DEFT Linux can be used for forensics examination of a disk drive or to recover deleted or otherwise lost files from a disk drive. If you have lost files on a device, such as a memory card from a camera, perhaps because you accidentally deleted them, you can use DEFT and the PhotoRec utility that comes with DEFT 7 to search for and recover those files. PhotoRec 6.13 comes with DEFT 7. PhotoRec was created by Christophe Grenier. It is also available for Mac OS X and Microsoft Windows systems.

To recover files using the Photorec utility, take the steps below after booting the system from the DEFT boot DVD. If you are trying to recover a large number of files or even a small number of files that are sufficiently large that you may exceed the storage space available in the computer's memory, you may also want to attach a USB device, such as a USB "thumbdrive" to use as the storage location for recovered files before you start Photorec. You may need to use the MountManager utility to mount the device in read/write mode.

  1. Click on the "d" at the lower, left-hand corner of the screen.
  2. Select DEFT.
  3. Select Carving tools.
  4. Select Photorec.
  5. Select the device you wish to search for photos by using the cursor keys and then hit Enter to proceed.

    Select input device

  6. If you wish to select a particular partion, choose the relevant one, otherwise you can choose "No partition" to search the whole disk. Hit Enter when you've made your selection using the arrow keys.

    Select partition

  7. Choose the type of file system for the device. A Linux filesystem will typically be ext or ext3. If you are searching a memory card from a camera, you would typically select "Other" for FAT/NTFS/HFS+/ReiserFS/...

    Choose filesystem

  8. Choose the output directory where the recovered files will be stored. By default, PhotoRec will show you the disk from which it is run, but if you are running it from a boot disc loaded into memory, you may not have enough free storage space available in memory to hold all of the available recovered files. In that case, you may need to change the output location. In any case, you will likely want to store the recovered files elsewhere than in the system's memory, since, otherwise when you reboot they will no longer be available.

    Select output directory

  9. When you have chosen the output directory where you want to store the recovered files, hit C to select it.

    Hit C to choose output directory

  10. When the recovery process is completed, you will see a notice regarding how many files were saved in the output directory you specified. The utility creates recup_dir.n directories, where n is a number starting at "1", to hold the recovered files beneath the directory you specified.

    Photorec recovery completed

  11. Hit Enter to quit the utility when the file recovery process is completed. Keep selecting Quit until you see the "PhotoRec exited normally message.


TechRabbit ad 300x250

Justdeals Daily Electronics Deals1x1 px

Valid HTML 4.01 Transitional

Created: Thursday April 5, 2012